BY ORDER OF THE SECRETARY OF THE AIR FORCE AIR FORCE INSTRUCTION 91-107 6 APRIL 1994 ACCESSIBILITY: UNITED STATES AIR FORCES IN EUROPE Supplement 1 MARCH 2007 Safety DESIGN, EVALUATION, TROUBLESHOOTING, AND MAINTENANCE CRITERIA FOR NUCLEAR WEAPON SYSTEMS COMPLIANCE WITH THIS PUBLICATION IS MANDATORY Publications and forms are available on the e-publishing website at www.e-publishing.af.mil for downloading or ordering. RELEASABILITY: There are no releasability restrictions on this publication. OPR: HQ AFSA/SENA Certified by: HQ USAF/SEC (Lt Col Kirby M. Fetzer) Supersedes AFR 122-10, 14 May 1990. Pages: 12 (USAFE) OPR: HQ USAFE/SEW Certified by: HQ USAFE/SEW (Maj Terrill D. Roberts) Supersedes AFI 91-107_USAFESUP1, Pages: 3 15 February 2001 This instruction implements AFPD 91-1, Nuclear Weapons and Systems Surety. It directs Air Force activities to comply with the minimum Air Force safety criteria to develop and evaluate nuclear weapon systems for nuclear safety certification and specifies the criteria for maintaining and troubleshooting loaded nuclear weapon systems. It applies to all organizations that design, develop, modify, evaluate, or operate a nuclear weapon system. It does not apply to the Air Force Reserve and Air National Guard. Send major command (MAJCOM) supplements to this instruction to HQ AFSA/SEN, 9700 Avenue G, Kirtland AFB NM 87117-5670 for coordination and to HQ USAF/SE, 1400 Air Force Pentagon, Washington DC 20330-1400 for approval before publication. (USAFE) AFI 91-107, 6 April 1994, is supplemented as follows: This supplement applies to all United States Air Forces in Europe (USAFE) units. It does not apply to Air Force Reserve Command (AFRC) or Air National Guard (ANG) units. Ensure that all records created as a result of processes prescribed in this publication are maintained in accordance with Air Force Manual (AFMAN) 37-123 (will convert to AFMAN 33-363), Management of Records, 31 Aug 1994 and disposed of in accordance with the Air Force Records Disposition Schedule (RDS) located in AFRIMS (AF Portal).
2 AFI91-107_USAFE_I 1 MARCH 2007 SUMMARY OF CHANGES This is the first publication of AFI 91-107, substantially revising AFR 122-10. It directs compliance with AFMAN 91-118 (formerly AFR 122-10); cross-references the list of terms and definitions used in the 91-100 series documents ( paragraph 1.); adds tables for unintentional significant nuclear yield and critical function numerical requirements ( Table 1. and Table 2.); and adds general criteria for maintaining and troubleshooting loaded nuclear weapon systems. (USAFE) This document is substantially revised and must be completely reviewed. Extensive changes in policies and procedures required a complete revision of this publication. Section A Scope and Responsibilities 1. Terms and Definitions. The terms used in this instruction are defined in AFI 91-101, Air Force Nuclear Weapons Surety Program (formerly AFR 122-1). 2. Criteria Applicability: 2.1. Department of Defense (DoD) Safety Standards. The DoD Nuclear Weapon System Safety Standards form the basis for the Air Force's nuclear weapon system safety design and evaluation criteria. 2.2. Nuclear Safety Design Certification. AFMAN 91-118, Safety Design and Evaluation Criteria for Nuclear Weapon Systems (formerly AFR 122-10), contains the minimum design and evaluation criteria required to certify nuclear weapon systems according to AFI 91-103, Air Force Nuclear Safety Certification Program (formerly AFR 122-3). 2.2.1. The criteria in AFMAN 91-118 don't invalidate the safety requirements in other DoD publications, but Air Force activities must apply whichever criteria are more stringent. 2.2.2. Because the Air Force's goal is to design a system that significantly exceeds the basic safety criteria, the weapon system designer may add reasonable safety features to improve safety yet meet operational design requirements. 2.2.3. The Air Force or the Department of Defense may prohibit or restrict operational use of a nuclear weapon system if the minimum safety criteria are not satisfied. 2.3. Definition of Requirements. Design agencies implement these safety criteria from the start of weapon system development by including them in appropriate formal source documents. These documents include: Program Management Directive. Mission Need Statement. Operational Requirements Document. Operational Plan Data Document. Stockpile-to-Target Sequence. Military Characteristics.
AFI91-107_USAFE_I 1 MARCH 2007 3 Weapon System Specifications. 2.4. Modifications to Existing Systems. This instruction doesn't require modifications of an existing operational system solely to meet these safety criteria. However, when modifying an existing system apply these criteria to at least the part of the system that's being modified. 2.5. Troubleshooting and Maintenance Criteria. Weapon system designers must apply these criteria when developing technical orders (TO) or other certified procedures for troubleshooting and maintaining loaded nuclear weapon systems. Field-level maintenance personnel must use these criteria to perform troubleshooting and maintenance operations. 2.5.1. (Added-USAFE) Include the fault troubleshooting and maintenance operation policies in the basic publication and this supplement in the training of personnel who load, monitor, maintain nuclear weapons, perform maintenance on nuclear loaded aircraft or have supervisory or management responsibility for same. Document training according to current guidance. Additionally, brief the commanders of these personnel on the requirements of the basic instruction and this supplement. 3. Responsibilities: 3.1. Headquarters, Air Force Safety Agency, Directorate of Nuclear Surety (HQ AFSA/SEN): Develops Air Force safety design and evaluation criteria. Approves deviation requests. Identifies criteria for, and approves troubleshooting and maintenance procedures and operations on loaded nuclear weapon systems. 3.2. Operating and Engineering Major Commands (MAJCOM): Ensure that troubleshooting and maintenance procedures and operations on loaded nuclear weapon systems comply with the criteria outlined in this AFI. Ensure that new weapon system developments and modifications to existing weapon systems comply with the minimum Air Force safety design and evaluation criteria specified in AFMAN 91-118. Request any necessary deviations and provide supporting engineering analyses (see Section B). Section B Deviations and Recommendations 4. Deviations to Air Force Safety Design and Evaluation Criteria: 4.1. Requests for Deviations. Some innovative designs or advances in technology, while conflicting with the specific criteria in AFMAN 91-118, may appear to meet the objectives of the DoD Nuclear Weapon System Safety Standards or to provide a significant safety advancement. In these cases, the engineering MAJCOM sends a deviation request to HQ AFSA/SEN. Send the request and supporting documents early enough in the system development to allow for an adequate analysis and to minimize the impact on system development if HQ AFSA/SEN doesn't approve the deviation.
4 AFI91-107_USAFE_I 1 MARCH 2007 4.1.1. (Added-USAFE) Prior to submittal to Headquarters, Air Force Safety Center/Weapons, Space, and Nuclear Safety Division (HQ AFSC/SEW), 9700 Avenue G, SE Kirtland AFB, NM 87117-5670 forward requests for deviations by non-united States (U.S.) North Atlantic Treaty Organization host nations to 498th Nuclear Systems Group (NSG) Operating Location-Engineering Liaison/Engineering Liaison Office (OL-EL/ELO) Unit 8745, APO AE 09094-8745. All requests for deviations should provide a clear and complete explanation of all pertinent known facts. Include photographs when appropriate. Identify and document existing methods of operation, system support and shortfalls to minimum design criteria to AFMAN 91-118, Safety Design and Evaluation for Nuclear Weapon Systems, and changes required to operation and system support to meet AFMAN 91-118 minimum design criteria. 4.1.2. (Added-USAFE) Prior to submittal to HQ AFSC/SEW, forward requests for deviations by U.S. units to Weapons Safety Division (HQ USAFE/SEW), Unit 3050 Box 165, APO AE 09094-0165. All requests for deviations should provide a clear and complete explanation of all pertinent known facts. Include photographs when appropriate. Identify and document existing methods of operation, system support and shortfalls to minimum design criteria to AFMAN 91-118 and changes required to operation and system support to meet AFMAN 91-118 minimum design criteria. 4.2. Supporting Documents. A deviation request must include an engineering analysis that shows how the proposed design meets or exceeds the intent of the design criteria. 5. Recommendations for Improvements. Send suggestions for improving the design and evaluation criteria in AFMAN 91-118 to HQ AFSA/SEN, 9700 Avenue G, Kirtland AFB NM 87117-5670. Include a proposed text with supporting documentation. 5.1. (Added-USAFE) Send recommendations for improving the design and evaluation criteria in AFMAN 91-118 to HQ USAFE/SEW, Unit 3050 Box 165, APO AE 09094-0165. HQ USAFE/SEW will coordinate with appropriate HQ USAFE staff agencies prior to submittal to HQ AFSC/SEW. Section C General Design Philosophy and Numerical Requirements 6. Nuclear Weapon System Safety Design Philosophy. The Air Force is responsible for protecting against the premature detonation of a nuclear weapon in both normal and credible abnormal environments. Nuclear weapon system designs provide such protection by controlling the system's critical functions in the sequence that leads to weapon detonation. To a significant extent, nuclear safety depends on the primary safety devices and the features that control these critical functions: Authorization. Prearming. Launching. Releasing. Arming. Targeting.
AFI91-107_USAFE_I 1 MARCH 2007 5 7. Critical Function Numerical Requirements. To demonstrate adequate control of critical functions, nuclear weapon system designs must meet Air Force-established numerical probability requirements. 7.1. For normal environments, the weapon system designer must show within the calculated probability of occurrence that inadvertent prearming, launching, releasing or jettisoning, arming, or erroneous targeting are highly unlikely during the system's lifetime. 7.2. For credible abnormal environments, the weapon system designer must incorporate safety features that serve as positive measures into the design of combat delivery vehicles to protect against inadvertent critical function activation. 7.3. Consult Table 1. and Table 2. for the Air Force-established numerical probability requirements. Table 1. gives the probability requirements for obtaining an unintentional significant nuclear yield (greater than 4 pounds TNT equivalent) from nuclear bombs, warheads, and other nuclear devices because of faults and failures in the nuclear weapon system. Table 2. gives the probability requirements for preventing an inadvertent critical function activation because of system faults and failures. Table 1. Unintentional Significant Nuclear Yield Numerical Requirements for Nuclear Bombs warheads, and Other Nuclear Devices. R U L E A The probability of obtaining a nuclear yield is less than Table 2. Inadvertent Critial Function Activation Numerical Requirements. B in the absence of 1 10-9 per weapon over the stockpile lifetime bomb- or warhead-unique prearming, environment, or trajectory stimuli. 2 10-4 per event (see note) the arming signal. 3 10-6 per weapon during exposure to abnormal environments unique prearming or environmental stimuli. NOTE: The Air Force defines an "event" as the application of a prearm command and deliberate deployment (weapon launch or release). R A B C U L For the critical function the probability of obtaining E a nuclear yield is less than in the event of 1 Authorization none (See note 1). 2 Prearming 10-6 per delivery vehicle over the system's lifetime inadvertent transmission of prearm command (see note 2).
6 AFI91-107_USAFE_I 1 MARCH 2007 R A B C U L For the critical function the probability of obtaining E a nuclear yield is less than in the event of 3 Arming 10-4 per prearmed weapon arming and fuzing system failure resulting in arming after the system has been prearmed but before launch or release. 4 Launching 10-7 per missile over the system's lifetime 10-12 per missile over the system's lifetime 5 Releasing 10-6 per weapon station over the system's lifetime accidental propulsion system ignition (see note 3). inadvertent programmed launch of ground-launched missile during fully assembled weapon system operation. inadvertent release or jettison of a bomb or missile when release system is locked (see note 4). 10-3 per unlocking event inadvertent release or jettison of a bomb or missile when release system is unlocked (see note 4). 6 Targeting 10-3 per missile erroneous issuance of good guidance signal (for ground-launched missiles). 7 (See note 5) 10-4 per delivery vehicle over the system's lifetime inadvertent application of power or signals (other than the prearm command) to warhead or bomb interface. NOTES: 1. Safety evaluations of combat delivery vehicle aircraft systems must consider that the authorization device is part of the command and control function and assume the authorization device has been activated. Safety criteria must be met with the authorization device activated. For ground-launched missile systems (for which the user accepts the restriction that the authorization device will not be activated until immediately before intended use of the missile), safety studies and calculations may recognize and take credit for any safety enhancement that the authorization device provides. 2. Designers must include positive safety features to prevent inadvertent prearming in credible abnormal environments. 3. "Accidental ignition" doesn't include nonpropulsive burning or explosion in the propulsion system. 4. "Inadvertent release or jettison" doesn't include cases when weapons separate from the aircraft because of catastrophic structural failure of the aircraft rather than operation of the release system. 5. Although not a critical function, weapon system designers must apply this numerical requirement as an additional positive safety measure.
AFI91-107_USAFE_I 1 MARCH 2007 7 Section D Troubleshooting and Maintenance Operations 8. General Criteria. When a fault occurs on a loaded nuclear weapon system (that is, a combat delivery-capable system with one or more nuclear weapons mechanically and electrically connected in a normal operational configuration), the primary consideration is to ensure that the system is safe and weapons are not subjected to inadvertent power application or control signals. 8.1. Weapon system designers must define allowable troubleshooting and maintenance operations for loaded nuclear weapon systems in applicable weapon system TOs or other certified procedures. Troubleshooting and maintenance operations must: Prohibit using any nuclear weapon as troubleshooting tool. Only use equipment and procedures certified according to AFI 91-103. Be consistent with applicable nuclear weapon system safety rules and approved technical data. Require that nuclear weapons be immediately and safely isolated from potential danger while maintaining appropriate physical security when a malfunction occurs. 8.2. If the authorized procedures don't adequately address the specific fault, the operating MAJCOM must consult with the engineering MAJCOM, the Directorate of Special Weapons (SA-ALC/NW), and the Directorate of Nuclear Surety (HQ AFSA/SEN). 8.2.1. (Added-USAFE) Contact the following offices prior to submittal to HQ AFSC/SEW for assistance: 8.2.1.1. (Added-USAFE) F-15E or F-16C/D units contact Munitions Division (HQ USAFE/ A4W), Unit 3050 Box 105, APO AE 09094-0105. Additionally, notify or provide courtesy copy of assistance request to HQ USAFE/SEW. 8.2.1.2. (Added-USAFE) F-16A/B or PA-200 units contact 498th NSG, OL-EL/ELO, Unit 8745, APO AE 09094-8745. Additionally, notify or provide courtesy copy of assistance requests to HQ USAFE/A4W and HQ USAFE/SEW. 8.3. Field-level maintenance personnel must not perform maintenance operations that have a significant affect on the nuclear weapon system's primary structure, propulsion, or electrical and hydraulic power systems unless the Air Force has established specific procedures for these operations. The purpose of this restriction is to protect against the high probability of exposing nuclear weapons to an adverse environment, particularly if a safety-related incident occurs. 8.4. To conduct other maintenance operations prohibited by these criteria but that have a valid operational requirement, the operating MAJCOM must request approval from HQ AFSA/SEN. 9. Criteria Unique to Aircraft Systems: 9.1. Nuclear System Faults. When a nuclear system fault occurs on a loaded nuclear combat aircraft, cease all operations and take appropriate actions to identify, locate, and correct the fault. The engineering MAJCOM determines whether the system fault is critical by conducting a technical assessment of its potential impact on the nuclear weapons or the weapon system's primary nuclear safety features and the possible hazards associated with troubleshooting the fault. The MAJCOM's
8 AFI91-107_USAFE_I 1 MARCH 2007 determination is the basis for any TO procedure that permits troubleshooting. Troubleshooting procedures must adhere to the following criteria: Use built-in test (BIT) system capabilities, rather than determinations by field-level personnel, to identify faults. Use only initial fault detection data to identify the fault, and prohibit diagnostic testing to identify the fault while nuclear weapons are electrically mated. 9.1.1. Critical Faults. For critical faults, isolate the affected nuclear weapons from the fault before initiating troubleshooting. The manner in which weapons are isolated depends on the type of fault and the potential for inadvertent application of power or control signals to the weapon interface. Ways to isolate weapons include: Downloading the weapons. Demating the electrical signal lines to the weapons and mechanically safing the release system. Demating the electrical signal lines to both the weapons and the release system. 9.1.1.1. If authorized procedures are insufficient or inappropriate or if uncertainty exists about nuclear weapon impacts or the proper maintenance response, the operating MAJCOM must: Consult with SA-ALC/NW to determine the appropriate course of action. Declare weapons nonoperational that could have been affected by the fault. Keep weapons in nonoperational status and do not load them on a combat delivery aircraft until authorized by SA-ALC/NW. Prohibit performance of electrical checks on these weapons unless directed by SA-ALC/NW or until the original fault is resolved and the weapons have been returned to operational status. 9.1.1.1.1. (Added-USAFE) Prohibit Permissive Action Link (PAL) operations on a weapon declared non-operational due to critical faults until released by appropriate authority. Refer to Emergency Action Procedures (EAP) Volume IV, for additional information. 9.1.1.2. Nuclear weapons must remain isolated until the fault is identified, located, and corrected or the fault is isolated to the nuclear weapons. Only then can the aircraft be operationally certified (that is, tested to verify system operability and safety) as being mission capable. When personnel can't identify the cause of the fault, the operating MAJCOM must authorize the aircraft certification. However, upon receipt of proper command authority, the aircraft may be declared operationally certified if each of these conditions are met: A substitute aircraft is not available. Nuclear weapon system safety rules and TO restrictions are not violated. The fault is isolated to either specific weapon stations or a component associated only with those stations and the faulty stations are not loaded. The fault can't cause or contribute to a critical fault on any loaded station. Note: As used here, "station" refers to an individual weapon location rather than a carriage store clip-in or launcher connection.
AFI91-107_USAFE_I 1 MARCH 2007 9 Competent authority (not lower than the group commander for logistics or equivalent) approves the loading. 9.1.1.2.1. (Added-USAFE) USAFE aircraft operational certification authorization offices are: 9.1.1.2.1.1. (Added-USAFE) F-15E or F-16C/D Units: Weapon Systems (HQ USAFE/A4WS) Unit 3050 Box 105, APO AE 09094-0105. 9.1.1.2.1.2. (Added-USAFE) F-16A/B or PA-200: 498th NSG, OL-EL/ELO, Unit 8745, APO AE 09094-8745. 9.1.2. Noncritical Faults. For faults that the engineering MAJCOM has determined to be noncritical, the nuclear weapons may remain electrically mated during troubleshooting operations. However, every attempt should be made to isolate the weapons unless isolating the weapons causes a severe operational impact. 9.1.2.1. Identify faults unmistakably before declaring them noncritical. If the BIT system's fault identification is ambiguous or inconclusive or if personnel can't confidently assess the potential hazards associated with corrective actions, treat the fault as critical and apply the requirements of paragraph 9.1.1. 9.1.2.2. Treat as critical any nuclear system fault that prevents electrical monitoring of the nuclear weapon's status. This condition includes hardware and software failures that prevent execution of the monitoring function and failures that prevent proper display of the results of a monitoring function. 9.1.2.3. Before developing troubleshooting procedures, the engineering MAJCOM will delineate specific instructions for each BIT system fault that: Verify the reliability and accuracy of BIT data. Assess the potential consequences of the actions for each fault to assure that troubleshooting won't adversely impact nuclear safety. Request evaluation and approval from HQ AFSA/SEN before troubleshooting noncritical faults. 9.2. Mechanical Mating Problems. When a mechanical mating problem occurs that prevents load completion, verify the integrity of electrical connections with the aircraft nuclear system before proceeding with the loading operation. 9.2.1. If resolving the mechanical problem doesn't involve the aircraft nuclear system ( for example, an out-of-adjustment bomb rack rigging or a physically incompatible pullout cable), proceed with the loading operation after correcting the mechanical problem. The aircraft remains operationally certified. 9.2.2. If resolving the mechanical problem requires removing and replacing or reinstalling a component in the aircraft nuclear system, operationally certify the aircraft after correcting the mechanical problem. 9.2.3. Before attempting a subsequent mating, use applicable TO procedures to inspect the aircraft and nuclear weapons for damage.
10 AFI91-107_USAFE_I 1 MARCH 2007 9.3. Electrical Power Application. Keep application of electrical power to a loaded nuclear combat aircraft to a minimum. 9.4. Minor Maintenance. Perform only minor maintenance and operational checks not related to the nuclear weapon interface according to approved technical data and the nuclear weapon system safety rules. Examples of these operations include: Preflight checks. Aircraft servicing. Fuel management actions. Operational checks of lighting, navigation, radar, and communications systems. 9.5. Nonnuclear System Faults. When a fault occurs outside the nuclear system on a loaded nuclear combat aircraft, perform corrective actions according to specific aircraft TOs. When corrective actions for a nonnuclear fault require personnel to demate weapons, perform all postload electrical and mechanical checks after again mating the weapons. The aircraft remains operationally certified. 9.6. Prohibited Maintenance. Observe the restrictions described in TO 11A-1-33, Handling and Maintenance of Explosives Loaded Aircraft. In addition, personnel must not conduct these specific maintenance actions on loaded nuclear combat aircraft as well as noncombat delivery vehicles (cargo aircraft) with nuclear weapons aboard: Aircraft engine changes. Major landing gear maintenance. Major structural repair. Major disruptions to the fuel system. Repairing the launcher primary structure or any other structure that directly supports the loaded nuclear weapon or nuclear weapon system. 10. Criteria Unique to Ground-Launched Missile Systems. Use only approved procedures to perform troubleshooting and maintenance operations while a warhead or reentry system is mated to the missile. If maintenance personnel can't identify the fault by using approved procedures, remove the warhead or reentry system before proceeding. 10.1. Prohibit procedures that could: Send signals to a warhead or reentry system. Jeopardize the safety of the warhead, reentry system, launch system, or launch control system. Arm or bypass safety interlocks. 10.2. Use only equipment and procedures certified according to AFI 91-103 to troubleshoot any fault or failure in the missile, its associated equipment, or any component that is part of the command and control of the missile. Note: The Air Force doesn't consider replacing the "most likely to fail" item to be troubleshooting when personnel replace the item using approved technical data. 10.3. Allow only experienced personnel who are certified under the Personnel Reliability Program, task-qualified, and properly trained on the equipment to perform troubleshooting.
AFI91-107_USAFE_I 1 MARCH 2007 11 10.4. When faults occur that personnel can't identify by using approved procedures, the operating MAJCOM must provide guidance after consulting with the engineering MAJCOM's safety office. 10.5. Don't conduct these maintenance operations on a loaded nuclear missile system: Welding operations in or on the launcher (unless specifically authorized by the engineering MAJCOM). System-level testing that could inject critical commands. Use of uncertified test equipment. Canister and suspension system work (except minor servicing or repair). Ordnance testing or activation. JAMES L. COLE, JR., Brig General, USAF Chief of Safety (USAFE) ROBERT G. WRIGHT, JR., Colonel, USAF Director of Safety
12 AFI91-107_USAFE_I 1 MARCH 2007 Attachment 1 (Added-USAFE) GLOSSARY OF REFERENCES AND SUPPORTING INFORMATION References AFMAN 37-123, Management of Records, 31 August 1994 AFMAN 91-118, Safety Design and Evaluation for Nuclear Weapon Systems, 18 January 1994 Emergency Action Procedures (EAP) Volume IV, current edition Abbreviations and Acronyms EAP Emergency Action Procedures NSG Nuclear Systems Group OL-EL-ELO Operating Location-engineering Liaison/Engineering Liaison Office U.S. United States USAFE United States Air Forces in Europe